CVE-2025-42969: Improper Neutralization of Input During Web Page Generation

SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to inject a malicious script into a dynamically crafted URL. The victim, when tricked into clicking on this crafted URL unknowingly executes the malicious payload in their browser. On successful exploitatio...

PT-2025-28288 · Sap · Sap Netweaver Application Server Abap +1

Name of the Vulnerable Software and Affected Versions: SAP NetWeaver Application Server ABAP and ABAP Platform affected versions not specified Description: The issue allows an unauthenticated attacker to inject a malicious script into a dynamically crafted URL. When a victim clicks on this crafte...

SAP NetWeaver Application Server ABAP and ABAP Platform 跨站脚本漏洞

SAP NetWeaver Application Server ABAP and ABAP Platform is a platform for running and developing applications based on the ABAP language from SAP, Germany. A cross-site scripting vulnerability exists in SAP NetWeaver Application Server ABAP and ABAP Platform, which originates from an...

CVE-2025-42956: Improper Neutralization of Input During Web Page Generation

SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to create a malicious link which they can make publicly available. When an authenticated victim clicks on this malicious link, injected input data will be used by the web site page generation to create...

SAP NetWeaver ABAP Server和SAP ABAP Platform 安全漏洞

SAP NetWeaver ABAP Server and SAP ABAP Platform are both products of SAP, Germany.SAP NetWeaver ABAP Server is a Web application server used as an SAP product.SAP ABAP Platform is an ABAP-based SAP SAP NetWeaver ABAP Server is a Web application server for SAP products. A security vulnerability...

The vulnerability of the ABAP Keyword Documentation component of the SAP NetWeaver software integration platform allows attackers to perform cross-site scripting attacks.

The vulnerability of the ABAP Keyword Documentation component in the SAP NetWeaver software integration platform is related to insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

SAP NetWeaver AS ABAP Missing Authorization Check (3600840)

The remote SAP NetWeaver ABAP server may be affected by a missing authorization check vulnerability. RFC inbound processing does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation the attacker could critically...

SAP NetWeaver AS ABAP Authorization Bypass Vulnerability

The remote SAP NetWeaver ABAP server may be affected by an authorization bypass vulnerability. SAP NetWeaver allows an attacker to bypass authorization checks, enabling them to view portions of ABAP code that would normally require additional validation. Once logged into the ABAP system, the...

The vulnerability of the SAP NetWeaver Application Server ABAP software integration platform lies in the lack of a mechanism for verifying the authenticity of incoming RFC requests. This allows attackers to increase their privileges.

The vulnerability of the SAP NetWeaver Application Server ABAP software integration platform is related to the absence of a mechanism for verifying the authenticity of incoming RFC requests during processing. Exploiting this vulnerability allows an attacker operating remotely to increase their...

CVE-2025-31325: Improper Neutralization of Input During Web Page Generation

Due to a Cross-Site Scripting vulnerability in SAP NetWeaver ABAP Keyword Documentation, an unauthenticated attacker could inject malicious JavaScript into a web page through an unprotected parameter. When a victim accesses the affected page, the script executes in their browser, providing the...

CVE-2024-30218

The ABAP Application Server of SAP NetWeaver as well as ABAP Platform allows an attacker to prevent legitimate users from accessing a service, either by crashing or flooding the service. This leads to a considerable impact on availability...

CVE-2024-27900

Due to missing authorization check, attacker with business user account in SAP ABAP Platform - version 758, 795, can change the privacy setting of job templates from shared to private. As a result, the selected template would only be accessible to the owner...

CVE-2024-21738

SAP NetWeaver ABAP Application Server and ABAP Platform do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. An attacker with low privileges can cause limited impact to confidentiality of the application data after successful exploitation...

CVE-2023-28763

SAP NetWeaver AS for ABAP and ABAP Platform - versions 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker authenticated as a non-administrative user to craft a request with certain parameters which can consume the server's resources sufficiently to make it unavailable over the...

CVE-2023-0014

SAP NetWeaver ABAP Server and ABAP Platform - versions SAPBASIS 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, KERNEL 7.22, 7.53, 7.77, 7.81, 7.85, 7.89, KRNL64UC 7.22, 7.22EXT, 7.53, KRNL64NUC 7.22, 7.22EXT, creates information about system identity in an ambiguo...

CVE-2023-26459

Due to improper input controls In SAP NetWeaver AS for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, an attacker authenticated as a non-administrative user can craft a request which will trigger the application server to send a request to ...

CVE-2023-29185

SAP NetWeaver AS for ABAP Business Server Pages - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an attacker authenticated as a non-administrative user to craft a request with certain parameters in certain circumstances which can consume the server's resources...

CVE-2023-29108

The IP filter in ABAP Platform and SAP Web Dispatcher - versions WEBDISP 7.85, 7.89, KERNEL 7.85, 7.89, 7.91, may be vulnerable by erroneous IP netmask handling. This may enable access to backend applications from unwanted sources...

CVE-2023-23854

SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges...

CVE-2023-33986

SAP CRM ABAP Grantor Management - versions 700, 701, 702, 712, 713, 714, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting XSS vulnerability. After successful exploitation, an attacker can cause limited impact on confidentiality and integrity of the applicatio...